oxy 0.5.1 82202a4d0025
Keyless agents can create release tags (#129), and oxy 0.5.0 and older can clone again after one did (#131): clients send Oxy-Features and an oxy/<version> User-Agent, and a server leaves out tags only a certificate authorizes for a client that does not declare certified-tags. Details in CHANGELOG.md under 0.5.1.
- Author
- Andy McCall @andymccall <[email protected]>
- via
- agent
agent:claude@andymccall <[email protected]> · keyless, under your grant for changes,refs,seal · key 9ec946a7037b
- When
- · 2026-10-20 16:40 UTC
- Signature
- ◈ sealed by agent:claude@andymccall
- Hash
82202a4d0025798bbb6288e78c070c67cb8c6f409079e9364e5a109758201c99- Depends on
- 6f06d9f912b4 750251b21a96 8d80356371c5 8fd78eb52ad2 e4595038502a ee130dd9eef2 ff0af1ee299d
- Depended on by
- b260109d27c5 f0ef9778e587
- In bookmarks
- identical-sides main push-notes subrepo-pin-state
- In tags
- v0.10.0 v0.11.0 v0.5.1 v0.6.0 v0.7.0 v0.8.0 v0.9.0
- Edits
- 8 atoms, 0 tree operations, 3 files
Browse the tree at this change
modified CHANGELOG.md +2 −0
| … | 1 unchanged lines |
||
| 2 | 2 | ||
| 3 | 3 | ## Unreleased |
|
| 4 | 4 | ||
| 5 | + | ## 0.5.1 (2026-10-20) |
|
| 6 | + | ||
| 5 | 7 | - **oxy 0.5.0 and older can clone a repository again after a keyless agent tagged it (#131).** Since #129 a release tag may be signed by a ten-minute certified key, which released clients do not know how to authorize: they refused the tag (`key … may not create tags/v0.5.0 under this repository's policy`), and with it the whole clone, fetch or `oxy submodule update`. Clients now send `User-Agent: oxy/<version>` and declare what they understand in `Oxy-Features` (`certified-tags` so far; docs/protocol.md, *Client capabilities*). Under a policy, a server leaves out of its refs answer to a client that does not declare `certified-tags` every tag that only a certificate authorizes, so that client clones the rest as if the tag did not exist. The rule is `Repo::refs_for_client` in oxy-core; `oxy-server` gains a `Backend::adjust_refs` hook, given the request headers, whose default applies it, so `oxy serve` and every embedding host do. |
|
| 6 | 8 | - **Keyless agents can create release tags (#129).** `oxy tag create` and `oxy push` under a keyless home was refused "unknown key": the push did not carry the tag signer's identity and certificate, and tags were authorized only by keys the policy names, never by a certificate under a subject grant. The push now carries them, and a receiver authorizes a short-lived key's tag by a subject grant at its own clock, as it does a bookmark move, and records when it accepted it (OxygenHub signs that with its key). A fetch checks such a tag at that acceptance, or at its integrated time when the hub's log gives one, so a release tag made with a ten-minute key is still fetched months later. A fetch never checks it at the time the tag claims: without an acceptance the tag is left out with a warning (`tags/NAME not updated`), and the rest is fetched. A client keeps the acceptance and serves and pushes it with the tag, so a tag passed on to another remote, or cloned from a clone, keeps its time. The wire change is additive: tags in `refs` and `push` gain keys 4 to 6 (acceptance, log place, cosigned checkpoints), which older readers ignore. |
|
| 7 | 9 | ||
| … | 251 unchanged lines |
modified Cargo.lock +4 −4
| … | 1470 unchanged lines |
||
| 1471 | 1471 | ||
| 1472 | 1472 | [[package]] |
|
| 1473 | 1473 | name = "oxy" |
|
| 1474 | - | version = "0.5.0" |
|
| 1474 | + | version = "0.5.1" |
|
| 1475 | 1475 | dependencies = [ |
|
| 1476 | 1476 | "anyhow", |
|
| 1477 | 1477 | "clap", |
|
| … | 11 unchanged lines |
||
| 1489 | 1489 | ||
| 1490 | 1490 | [[package]] |
|
| 1491 | 1491 | name = "oxy-core" |
|
| 1492 | - | version = "0.5.0" |
|
| 1492 | + | version = "0.5.1" |
|
| 1493 | 1493 | dependencies = [ |
|
| 1494 | 1494 | "blake3", |
|
| 1495 | 1495 | "ed25519-dalek", |
|
| … | 20 unchanged lines |
||
| 1516 | 1516 | ||
| 1517 | 1517 | [[package]] |
|
| 1518 | 1518 | name = "oxy-server" |
|
| 1519 | - | version = "0.5.0" |
|
| 1519 | + | version = "0.5.1" |
|
| 1520 | 1520 | dependencies = [ |
|
| 1521 | 1521 | "axum", |
|
| 1522 | 1522 | "axum-server", |
|
| … | 6 unchanged lines |
||
| 1529 | 1529 | ||
| 1530 | 1530 | [[package]] |
|
| 1531 | 1531 | name = "oxy-strata" |
|
| 1532 | - | version = "0.5.0" |
|
| 1532 | + | version = "0.5.1" |
|
| 1533 | 1533 | dependencies = [ |
|
| 1534 | 1534 | "async-trait", |
|
| 1535 | 1535 | "bytes", |
|
| … | 1419 unchanged lines |
modified Cargo.toml +1 −1
| … | 2 unchanged lines |
||
| 3 | 3 | resolver = "2" |
|
| 4 | 4 | ||
| 5 | 5 | [workspace.package] |
|
| 6 | - | version = "0.5.0" |
|
| 6 | + | version = "0.5.1" |
|
| 7 | 7 | edition = "2021" |
|
| 8 | 8 | license = "MIT OR Apache-2.0" |
|
| 9 | 9 | ||
| … | 37 unchanged lines |